New York Life Insurance Co. has joined the long list of life insurance companies that have filed data breach notices with state regulators in connection with the Cl0p attack on MOVEit, a popular file transfer tool.
New York Life believes the attack may have exposed the personal information, including Social Security numbers, of 25,685 of its customers, according to a version of the notice posted by the Maine attorney general's office last week.
Vendors that serve New York Life and other companies use MOVEit to move large batches of the sensitive personal information used to administer insurance policyholder, annuity contract holder and pension plan participant information. Cl0p succeeded at stealing large batches of the data by finding a weakness in MOVEit and burrowing into the servers used to provide the MOVEit services.
Bert Kondruss, managing director of KonBriefing Research, estimates that MOVEit-related breach reports show the attack has affected at least 677 organizations and 41 million people around the world.
What It Means
Clients with a life insurance policy, an annuity or a retirement plan account may have already shown you a breach notice, or will show you a breach notice, and ask you what to do about it.
The Players
New York Life and most other life insurers that have filed MOVEit breach reports were affected because they employed Pension Benefit Information to help them keep track of insureds and plan participants.
PBI used MOVEit, a system provided by Progress Software Corp., to manage the data files supporting the tracking process.
"We recently learned of a security incident related to a third-party vendor," New York Life said in a comment on the breach. "This is a matter we take very seriously. The appropriate authorities were notified, as were the affected individuals."
A MOVEit system representative said the organization does not comment on pending litigation. "Our focus remains on working closely with customers so they can take the steps needed to further harden their environments, including applying the patches we have developed," the representative said.
The Immediate Impact
For clients, the immediate impact will be offers of free access to identity monitoring services.
New York Life, for example, is offering 12 months of identity monitoring services from Kroll.
Many other insurers are offering 12 to 24 months of Kroll services, or similar types of services from vendors such as Experian.
Clients may ask whether the identity services are legitimate and about what the identity monitoring services will do with their information.
